CVE-2025-53681 SQL injection in FortiMail

What is CVE-2025-53681?

CVE-2025-53681 is a medium-severity SQL injection vulnerability in Fortinet FortiMail, published on 12 May 2026. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

An improper neutralization of special elements used in an SQL Command ("SQL Injection&") vulnerability [CWE-89] vulnerability in Fortinet FortiMail 7.6.0 through 7.6.3, FortiMail 7.4.0 through 7.4.5, FortiMail 7.2.0 through 7.2.8 allows an authenticated privileged attacker to execute unauthorized code or commands via specifically crafted HTTP or HTTPS requests.

Weakness: CWE-89

Which versions are affected by CVE-2025-53681?

It affects 1 product.

Products include Fortinet Fortimail.

How do I fix CVE-2025-53681?

No fix has been published for CVE-2025-53681 yet. Limit exposure of the affected software until one is available.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2025-53681 being exploited?

There is no known exploitation of CVE-2025-53681 in the wild and no public exploit code.

Other vulnerabilities in Fortinet FortiMail

• CVE-2026-104286 Fortinet FortiMail Path Traversal Exploited Critical 9.8
• CVE-2021-36166 Auth bypass in Fortinet FortiMail Critical 9.8
• CVE-2021-24007 SQL injection in Fortinet FortiMail Critical 9.8
• CVE-2020-9294 Auth bypass in FortiMail Critical 9.8
• CVE-2023-47539 Auth bypass in FortiMail Critical 9.0

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-6mf6-qrvj-29vm.